Madison Williamson<\/p>\n\n\n\n
The Human element can not be understated. Without an operator a console completes no actions, beyond the normal checks for updates, and provides no use to an organization. Humans make computers smart, they give them meaning and purpose. They also create vulnerabilities inherent in our being, we are susceptible to helping another human in need, and can be tricked to allow access to systems that should be secure. Humans make or break a system, proper training and knowledge is required to keep a system secure and functioning.<\/p>\n\n\n\n
Humans create the guidelines a network’s architecture uses, they create the rules that a network runs on, and they dictate who has access to said network. We make the network secure and ensure it is able to complete its tasks. Access is required to complete these tasks and it is granted to other humans who are assigned with overseeing the network. Someone who keeps a password written down underneath their keyboard, on a note near their desk, or neglects to log out when they leave their station create an opening for a bad actor to take advantage of the opportunity afforded to them. A helpdesk tech who resets a password because someone sounds tired and stressed and has a baby crying in the background allows that person who only had a youtube video playing in the background to gain access to someone’s bank account or email. A lapse in security checklists creates an opening as the individual who failed to ensure the door was locked and secured before leaving allowed an individual to access key network devices.<\/p>\n\n\n\n
Hackers in 2020 utilized both social engineering and phishing via a fraudulent website. They contacted multiple Twitter employees and had them input credentials into a fake VPN. They were able to gain access to multiple accounts and used that access to trick people into paying over 12.86 BTC [1]. This could have been blocked if the employees followed company policy and reached out to their IT department through internal methods instead of trusting a stranger who claims to be your tech department. They could also have double checked the website url provided to them instead of blindly going where they were told, and ultimately since the human element is the weakest link, two factor authentication could have stopped this if utilized correctly.<\/p>\n\n\n\n
Poland experienced loss of RTUs and HMIs due to default passwords and weak MFA on edge systems such as VPNs. Hackers gained access and thanks to weak default passwords left on network equipment they were able to deploy malware onto the systems wiping company data and disrupting operations. Luckily the system did not experience any major outages, and due to this attack CISA sent out a message urging the USA energy sector to ensure default passwords are changed to something more complicated and difficult to breach. The Polish computer emergency response team was able to track down how this occurred and corrected the issues found in the system [2]. Simple steps such as stronger MFA, more complicated passwords, and better segmentation between operational tech and industrial control systems is all that needed to be applied to keep the system secure. Something the organization wouldn\u2019t have done unless required to.<\/p>\n\n\n\n
Humans make mistakes, we make errors, and we let our emotions get us into trouble. Those twitter employees could have prevented a hack if they didn\u2019t let the frustration of their job get to them and allow an individual who claims to be helping into their accounts. We see it all the time, someone who is tired of work and just wants an easy solution is given a false door to the solution that leads to a network being taken over. Organizations that allow an easy to use remote work VPN are asking to be taken advantage of, and the employees who may or may not be fully focused on their job might let it happen. Simply put the reason organizational requirements are the way they are is to ensure that the Human Factor doesn\u2019t cause loss in the organization. We restrict access to specific devices, require multiple authentication methods, and specify password requirements because humans would use their own laptops if allowed, they\u2019d login to a system with just a password, and that password would be 1234 if they could. We have to create these solutions to prevent our operators from being the weakest link in the network.<\/p>\n\n\n\n
Sources:<\/p>\n\n\n\n
[1] https:\/\/www.justice.gov\/opa\/press-release\/file\/1300246\/dl?inline=<\/a><\/p>\n\n\n\n